{"openapi":"3.1.0","info":{"title":"XGuard Secretless Agent Gateway","version":"5.0.2","description":"Protect AI agents from API-key exposure with encrypted reusable credential custody, short-lived scoped capabilities, server-side credential injection, Usage Credit metering and ProofRail signed execution evidence. Action Rail and x402 endpoints are compatibility surfaces."},"servers":[{"url":"https://api.xguardgate.com"}],"paths":{"/supported":{"get":{"summary":"Return x402 payment kinds supported by healthy upstream facilitators","responses":{"200":{"description":"Supported payment kinds"}}}},"/verify":{"post":{"summary":"Firewall-check and verify an x402 payment payload","responses":{"200":{"description":"Verification result"},"400":{"description":"Blocked by XGuard payment firewall"}}}},"/settle":{"post":{"summary":"Firewall-check, route and settle an x402 payment with replay protection and reconciliation","responses":{"200":{"description":"Settlement result"},"400":{"description":"Blocked by XGuard payment firewall"},"402":{"description":"XGuard usage credits required after free allowance"}}}},"/healthz":{"get":{"summary":"Control-plane and upstream health","responses":{"200":{"description":"Health"}}}},"/v1/receipts/{receipt_id}":{"get":{"summary":"Read a durable XGuard settlement receipt","parameters":[{"name":"receipt_id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Receipt"},"404":{"description":"Not found"}}}},"/v1/protocols":{"get":{"summary":"Discover XGuard protocol-neutral control-plane capabilities","responses":{"200":{"description":"Universal protocol manifest"}}}},"/v1/inspect":{"post":{"summary":"Classify and policy-check an agent transaction without forwarding it","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"target":{"type":"string"},"method":{"type":"string"},"headers":{"type":"object"},"body":{}},"required":["target"]}}}},"responses":{"200":{"description":"Detected protocol and policy result"}}}},"/v1/test":{"post":{"summary":"Free Agent Transaction Safety Test across x402, MPP, AP2, UCP, ACP and MCP","description":"Scores a supplied sample for retry safety, idempotency, context binding, replay uniqueness, freshness and auditability. The target is not contacted.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"target":{"type":"string"},"method":{"type":"string"},"headers":{"type":"object"},"body":{}},"required":["target"]}}}},"responses":{"200":{"description":"0–100 structural runtime-readiness report"},"400":{"description":"Invalid sample"}}}},"/v1/test/schema":{"get":{"summary":"Describe the free Agent Transaction Safety Test","responses":{"200":{"description":"Test schema and supported protocols"}}}},"/edge/{merchant-host}/{path}":{"parameters":[{"name":"merchant-host","in":"path","required":true,"schema":{"type":"string"}},{"name":"path","in":"path","required":true,"schema":{"type":"string"}}],"post":{"summary":"Proxy a DNS-authorized merchant transaction through XGuard","responses":{"200":{"description":"Upstream response"},"402":{"description":"Usage credits required"},"403":{"description":"Merchant hostname has not authorized XGuard Edge"}}}},"/facilitator":{"get":{"summary":"Machine-readable XGuard facilitator identity and routing capabilities","responses":{"200":{"description":"Facilitator metadata"}}}},"/discovery/resources":{"get":{"summary":"List x402 Bazaar resources reachable through XGuard catalogs","responses":{"200":{"description":"Aggregated x402 discovery resources"}}}},"/discovery/search":{"get":{"summary":"Search x402 Bazaar resources reachable through XGuard","responses":{"200":{"description":"Aggregated x402 discovery search results"}}}},"/v1/facilitator/route":{"get":{"summary":"Inspect the route XGuard would select for a network/scheme","responses":{"200":{"description":"Live compatible route recommendation"},"503":{"description":"No compatible live route"}}}},"/v1/actions":{"get":{"summary":"Discover XGuard Action Rail","responses":{"200":{"description":"Action Rail manifest"}}}},"/v1/actions/permits":{"post":{"summary":"Prepare one signed single-use AI action permit","responses":{"201":{"description":"Signed action permit"},"401":{"description":"XGuard key required"},"402":{"description":"Usage Credits required"},"428":{"description":"Scoped mandate required"}}}},"/v1/actions/execute":{"post":{"summary":"Execute the exact request bound to an XGuard action permit","responses":{"200":{"description":"Upstream response after controlled execution"},"402":{"description":"Usage Credits required"},"409":{"description":"Replay, state or binding conflict"},"503":{"description":"Ambiguous outcome; fail closed"}}}},"/v1/actions/pricing":{"get":{"summary":"Action Rail Usage Credit billing boundary","responses":{"200":{"description":"Pricing metadata"}}}},"/v1/actions/stats":{"get":{"summary":"Action Rail execution and billing counters","responses":{"200":{"description":"Durable counters"}}}},"/v1/egress":{"get":{"summary":"Discover XGuard Secretless Egress","responses":{"200":{"description":"Egress manifest"}}}},"/v1/egress/credentials":{"post":{"summary":"Store an encrypted upstream credential (operator only)","responses":{"201":{"description":"Credential metadata; secret is never returned"},"401":{"description":"XGuard key required"}}},"get":{"summary":"List operator credential metadata","responses":{"200":{"description":"Credential metadata"}}}},"/v1/egress/capabilities":{"post":{"summary":"Issue a short-lived scoped capability for an agent","responses":{"201":{"description":"Scoped capability"}}}},"/v1/egress/fetch":{"post":{"summary":"Execute one credential-backed outbound request using an XGuard capability","responses":{"200":{"description":"Upstream response"},"401":{"description":"Capability required"},"402":{"description":"Usage Credits required"},"403":{"description":"Capability or credential scope denied"},"503":{"description":"Billing/decryption/network ambiguity; no automatic replay"}}}},"/v1/egress/pricing":{"get":{"summary":"Secretless Egress Usage Credit boundary","responses":{"200":{"description":"Billing contract"}}}}},"primary_product":"XGuard Secretless Agent Gateway","primary_role":"credential broker and egress choke point for AI agents","secretless_egress":{"manifest":"https://api.xguardgate.com/v1/egress","providers":"https://api.xguardgate.com/v1/egress/providers","credential_management":"https://api.xguardgate.com/v1/egress/credentials","capability_issuance":"https://api.xguardgate.com/v1/egress/capabilities","agent_fetch":"https://api.xguardgate.com/v1/egress/fetch","pricing":"https://api.xguardgate.com/v1/egress/pricing","security_model":"operator holds reusable secret; agent receives scoped short-lived XGuard capability"},"canonical_identity":{"name":"XGuard Secretless Agent Gateway","version":"5.0.2","primary_product":"Secretless Egress","primary_role":"credential broker and controlled egress boundary for AI agents","site":"https://xguardgate.com","api":"https://api.xguardgate.com","mcp":"https://api.xguardgate.com/mcp"}}